Wispim — Privacy Policy

Version 1.13 · Effective date: 21 October 2026

1. Who we are (Controller)

Wispim is a teleprompter app for iPhone, iPad, Mac, Android phones and Windows PCs published by Evgeny Savochkin, a sole proprietor (jednoosobowa działalność gospodarcza) established in Poland (Polska). The app’s bundle identifier is com.wispim.ios on Apple devices; its application ID is com.wispim.android on Android; its package family name on Windows is EvgenySavochkin.WispimTeleprompter_b9n5b05321bkt. The parameter names in our analytics (§4) use the namespace com.onwards.

• Address: Aleksandra Gieysztora 4/97, 02-999 Warszawa, Polska
• Email: support@wispim.com
• NIP: 9512576713 · REGON: 526236847 · Registered in CEIDG (Centralna Ewidencja i Informacja o Działalności Gospodarczej)

The developer is the administrator danych osobowych (data controller) for the limited processing described below.

2. Our privacy approach

Wispim is built to keep your data on your device. There are no user accounts — you never sign in to anything of ours. Your scripts are stored on your device (on iPhone, iPad and Mac as local files; on Android in the app’s own database; on Windows as a local file in the app’s data folder in your Windows user profile) and are never uploaded to us. On Apple devices, if you have Wispim Pro and iCloud sync is switched on, a copy of your script library is also kept in your own private iCloud database: your Apple Account, your storage quota, and no access for us (§3(a)). The Android app has no sync; Android’s own backup can keep a copy in your Google account (§3(i)). The Windows app has no sync and makes no cloud copy (§3(k)). We do not sell your data, we show no ads, and we do not track you across apps or websites. Apart from the product analytics described in §3(c)–(e) and §4 — which you can turn off in the app at any time — Wispim sends us nothing.

3. What data is processed, and why

(a) Scripts and app content — your device, and, on Apple devices with Pro, your own iCloud. Scripts and their titles, imported documents and their file names, the speech the app recognises while you read, and your settings are stored or processed on your device. We never receive, store or transmit them.

On Apple devices, if you have Wispim Pro and iCloud sync is switched on in Settings → iCloud (on a Mac, Settings → Pro; it is on by default once you have Pro), a copy of your script library — the titles, the text and the per-script settings — is stored in the private CloudKit database of your own Apple Account, so that your other devices signed in to that Apple Account can read it. That copy is held by Apple, in your account and against your iCloud storage quota, and is governed by Apple's own privacy policy; we have no access to it, no way to read it, and it never reaches our systems. Nothing else is synced: not the take counter (§8), not your app settings, not the speech the app recognises, not your analytics preference. You can switch the sync off at any time, and Settings → iCloud → Remove the copy in iCloud (on a Mac, in Settings → Pro) deletes that copy from your Apple Account without touching the scripts on your device.

On Android, there is no iCloud or other sync: your scripts stay on your phone, apart from Android’s own backup described in §3(i).

On Windows, there is no iCloud or other sync, and Wispim makes no cloud copy: it keeps your scripts and settings only in the app’s data folder in your Windows user profile.

(b) Microphone and speech recognition. The microphone is used in Voice and Sound modes and, when enabled, for voice commands in Constant mode. Voice mode and voice commands use Apple’s SFSpeechRecognizer on Apple devices, Android’s built-in speech recognition on Android, and the Vosk speech recogniser inside the app on Windows. On Windows, voice commands use only that on-device recogniser; Voice mode can also use Windows’ online speech recognition, but only if you turn on Microsoft online speech, only for a language with no model on your PC (or whose model is still downloading), only for a language Windows lists for online speech, and only while Windows’ own Online speech recognition setting is on. A language with a model on your PC is always recognised on your PC, and voice commands are off in a take recognised online:

The Voice mode uses the microphone and speech recognition to follow your words. The Sound mode uses the microphone to measure loudness locally; it does not transcribe your reading. Sound and Constant modes can optionally listen for the app’s voice commands while the prompter runs, and for that the app asks for speech-recognition permission (on Windows there is no such permission; only the microphone is used); command recognition always runs on your device — where the language has no on-device model, voice commands are not available in those modes — and Wispim does not send command audio or transcripts. Other scroll modes do not use the microphone.

• On Apple devices: Where the language has an on-device recognition model, Wispim asks the operating system to recognise your speech on your device, and transcription then happens entirely on the device. Where the language has no on-device model, the operating system sends the audio to Apple’s servers to be processed under Apple’s terms. Server-based recognition is subject to a limit of about one minute per request. The app marks such languages in its language picker (“Needs internet · audio goes to Apple”) before you start, and the system shows an alert: “Speech data from this app will be sent to Apple to process your requests. This will also help Apple improve its speech recognition technology.” If an on-device model exists but repeatedly fails to load, the app falls back to Apple’s servers for the rest of that session. It also falls back to Apple’s servers for the rest of a take when, while you keep speaking, on-device recognition stops following what you read; if the servers then cannot be reached, it returns to on-device recognition. The full-screen prompter tells you so in a banner at the moment it happens; a take running in the floating window does not show that banner.
• On Android: Wispim uses the speech recognition built into Android, provided by Google (or the phone’s default speech service if Google speech services are unavailable). Wispim has no speech recognition of its own and no third-party speech software. Where your phone can recognise the language on the device, Wispim asks Android to do so; on Android 13 and later this is checked per language. An offline model may first need a one-time download, which Android handles. Arabic and Ukrainian have no offline model on Android: for these two languages, Voice mode sends your speech to Google’s servers, where it is processed under Google’s terms. The language picker marks both (“Needs internet · audio goes to Google”), and before a Voice take in either language the app tells you so and offers Constant mode, which works offline. On some phones other languages may also lack an offline model; speech in those languages is then sent to Google’s servers too. On Android 11 and earlier, Android gives apps no way to require recognition on the device. Wispim asks Google’s speech service to prefer offline recognition, but the service decides, and your speech may be processed on Google’s servers in any language. If an offline model exists but repeatedly fails, the app switches to Google’s servers for the rest of that session and tells you so in a banner. Constant-mode voice commands are recognised only on your device on Android too. Where no on-device recognition is available (always on Android 11 and earlier), voice commands are not available in Constant mode.
• On Windows: Wispim has its own speech recogniser, Vosk, an offline open-source library from Alpha Cephei Inc. (Apache 2.0 licence). The library is part of the app and runs on your PC; the language models it reads are not part of the app: Wispim downloads the ones you need directly from the Vosk project’s website (alphacephei.com), unless you add one yourself (below), and keeps them in its data folder on your PC. In a language with a model, your speech is recognised on your PC: the audio is held in memory only while you read and is never saved, and neither the audio nor the transcript leaves your PC. Windows has its own microphone privacy settings (Windows Settings › Privacy & security › Microphone); Wispim asks for no speech-recognition permission. While Settings → Voice is open and its window is active, Wispim also uses the chosen microphone for that tab’s level meter: it measures only how loud the sound is, to move the bar, and nothing is recognised, recorded, kept or sent. Wispim downloads the first model, for Windows’ first display language, by itself when you start it, if there is a model for that language, it is not on your PC yet and your connection is not metered (at the first start the welcome shows the progress and a Cancel button). On a metered connection, or with no connection, it downloads nothing at that start (at the first start the welcome shows a Download button instead). Until that model has been added or you have cancelled its download, Wispim tries again by itself at each later start on a connection that is not metered, also after a download that failed. After that it is not fetched again by itself, and neither is a model you remove. It downloads the model of another language when you ask: when you start Voice mode in a language with no model and press Download, in the language menu in Wispim’s bar, in Settings → Voice → More languages, or with the Download button that Settings → General shows when you choose that language as the interface language. When you ask, Wispim shows the size first. You can remove any downloaded model in Settings → Voice. As with any download, that website receives your PC’s IP address and the name of the model; the request carries no script text, no audio, no transcript and no identifier of you, and nothing else is sent. You can also add a model yourself: download it from the Vosk website (alphacephei.com/vosk/models; the “Vosk model list” button in Settings → Voice opens it in your web browser, and that visit is between your browser and that website), then choose its .zip file with “Add…” in the same place; Wispim reads only the file you choose. Either way, Wispim unpacks the model into its own data folder on your PC, and from then on it works offline. Microsoft online speech is off unless you turn it on, in Settings → Voice or where Wispim offers it when you start Voice mode in a language with no model. When it is on, a language with no model on your PC (or whose model is still downloading) is not read by Vosk: Windows’ online speech recognition recognises it instead, so while you read, Windows sends the audio over the internet to Microsoft’s speech service, where it is processed under Microsoft’s own terms and privacy statement. While the option is on, Windows may also contact Microsoft outside a take (for example when Wispim starts or when you turn the option on) to check that online speech is available for such a language; no audio is sent then. This works only for languages Windows lists for online speech, and only while Windows’ own setting Online speech recognition (Windows Settings › Privacy & security › Speech) is on; Wispim never changes that setting, it only opens the page. Online speech always uses the Windows default microphone. Wispim marks such a language in its language menu (“Online: your voice goes to Microsoft”) and says so where you turn the option on. A language with a model on your PC is recognised on your PC, never online, even while the option is on (a take that began online while its model was still downloading may finish online). Voice commands never go online: they work only with a model on your PC, and they are off in a take recognised online. Where a language has neither a model nor online speech, Voice mode and voice commands are not available in it.
• Wispim itself never stores or transmits your audio or transcripts. Any server-based processing is performed by Apple or Google, as applicable, as an independent controller under that provider’s own privacy policy. On Windows, if you turn on Microsoft online speech, the processing is performed by Microsoft under Microsoft’s own terms and privacy statement (https://privacy.microsoft.com/privacystatement). Legal basis: performance of the app functionality you request / your consent to microphone and speech use (GDPR Art. 6(1)(b)/(a)).

(c) Analytics (TelemetryDeck). We use privacy-first analytics from TelemetryDeck GmbH, Von-der-Tann-Str. 54, 86159 Augsburg, Germany, acting as our processor (podmiot przetwarzający) under Art. 28 GDPR. Data is stored exclusively in the EU. Wispim contains no third-party analytics SDK: the events listed in §4 are sent by our own code directly to TelemetryDeck. TelemetryDeck sets no cookies and performs no cross-app tracking. Legal basis: our legitimate interest in understanding and improving the app (GDPR Art. 6(1)(f)); you can object at any time simply by turning analytics off (§3(e)).

(d) The analytics identifier. Before anything leaves your device, the only identifier involved — on Apple devices, Apple’s per-vendor identifier for your device (identifier for vendor); on Android, Android’s device identifier for apps (ANDROID_ID), never the advertising ID — is specific to us and never seen by us. In each platform app it is combined with a fixed secret value (a salt; the Apple and Android apps use different salts) and reduced by our own code to a one-way SHA-256 hash. What we receive is that hash: a stable identifier for your installation that is not linked to you, from which the original identifier cannot be recovered, and which we have no way to connect to you, because we hold no accounts and no other data about you. It is not linked to you, and it is not anonymous either: the same value accompanies every event from the same installation — on Apple devices for as long as the app stays installed, and on Android for as long as your phone is not reset to factory settings, including after reinstalling the app. On Windows, no device or machine identifier is read at all: when you turn analytics on, the app generates a random value for that installation, keeps it with the app’s own settings on that computer, and combines it with the Windows app’s own salt — never the Apple or the Android app’s — before reducing it to the same one-way SHA-256 hash. Because nothing about the computer goes into it, that value says nothing about your machine, and removing the app together with its settings ends it: a later installation starts a new one. On Windows, turning analytics off erases that value, and if you turn analytics back on later the app generates a new one, so the events sent before and the events sent after cannot be connected to each other. TelemetryDeck states that it salts and hashes this value a second time when it is received.

(e) Turning analytics off. You can turn analytics off at any time, in the app, at Settings › Privacy & legal › Analytics (on Windows, Settings › General › Privacy & legal › Analytics). The switch is on by default on Apple devices and on Android. On Windows it is off by default: no event listed in §4 is sent until you turn it on. Turning it off stops every event listed in §4 and discards anything still queued on your device that has not yet been sent, including the copy held on disk between launches. One request already in flight at the moment you turn it off may still complete; there is no way for the app to recall it. Turning the switch back on resumes analytics. Because we hold no account, this preference is stored only on your device, and deleting the app deletes it. On Android, this preference is part of Android’s backup (§3(i)) and can come back if you reinstall the app and Android restores the backup.

(f) Opening these documents inside the app. When you open the Privacy Policy or the Terms from the app’s Settings, the app fetches the current version from the website that hosts them. On Android, the app first checks that the website answers (a short request that downloads no page content) and then opens the page in your browser; if the website does not answer within a few seconds, the app shows the copy built into the app. On Windows, the app does not fetch these pages itself: it asks Windows to open the page in your default browser, and the browser makes the request. As with any web page, the host’s server receives your IP address and standard connection data; the app sends nothing else, and we do not use this to identify you.

(g) Recording with Wispim’s camera (Android). On Android, Wispim can record video with your phone’s camera while your script scrolls. This needs the camera and microphone permissions. The recording (picture and sound from the microphone) is saved only on your phone, as an MP4 file in the Movies/Wispim folder, where your gallery app and other apps you allow to see your videos can find it. On Android 9 and earlier without access to your media, the video is kept in Wispim’s own folder instead, which is deleted with the app. If saving fails, the recording is discarded and Wispim tells you it could not be saved; no partial or temporary copy is kept. Wispim never uploads a recording. A video leaves your phone only if you tap Share and choose an app; that app then handles it under its own terms. While you record, the microphone also serves speech recognition as described in §3(b). Uninstalling Wispim does not delete videos in Movies/Wispim; delete them in your gallery or files app.

(h) Permissions on Android. On Android, Wispim asks only for these permissions, each after a short screen that says why: the microphone, for Voice and Sound modes, voice commands and the sound of camera recordings (§3(b), §3(g)); the camera, for recording with Wispim’s camera (§3(g)); Display over other apps, which you switch on in Android’s settings, so the floating window can show your script on top of other apps such as your camera app; and, on Android 13 and later, notifications. While the floating window is open, Android requires Wispim to show a notification; it holds the Pause, Close and Unlock controls and never shows your script, including on the lock screen. On Android 9 and earlier, Wispim may also ask for access to your media, only to save camera recordings in Movies/Wispim. Display over other apps lets Wispim draw its window; it does not let Wispim see or record another app, and Wispim asks for no permission that would. Wispim’s own internet connections on Android are only two: analytics to TelemetryDeck (§3(c)) and the check that these documents can be reached (§3(f)). Purchases (§5), speech recognition on Google’s servers (§3(b)) and Android’s backup (§3(i)) run through Google’s own apps and services on your phone.

(i) Android backup. On Android, if backup is switched on in your phone’s settings, Android includes Wispim’s data in your phone’s backup to your Google account and in transfers to a new phone: your script library (titles, text and per-script settings), app settings (including the analytics switch), your voice-command changes and the free-take counter. Not included: analytics events waiting to be sent, text shared into Wispim that has not yet been saved, temporary files and videos. Google holds the backup under your Google account and Google’s terms; we have no access to it. You can switch backup off in your phone’s settings. If you use a gallery or photo-backup app, it may copy videos from Movies/Wispim under its own settings.

(j) Permissions on Windows. On Windows, Wispim uses only the microphone, for Voice and Sound modes, voice commands and the level meter in Settings → Voice (§3(b)); Windows has its own microphone privacy settings, which you can review there. Wispim needs no camera, notification or location permission. The floating window registers three keyboard shortcuts with Windows (Ctrl+Alt+P, Ctrl+Alt+F and Ctrl+Alt+T), which you can switch off in Settings; apart from these, Wispim reacts to keys only while one of its own windows has focus. To stay above full-screen apps and follow you to another virtual desktop, the floating window notices which window is in front and that window’s position, size, type and virtual desktop; it does not read other windows’ titles or contents, and nothing about them is stored or sent. Its option to hide the window from screen sharing, on by default, only tells Windows to leave Wispim’s own window out of screen capture; Wispim records nothing of your screen. Wispim’s own code makes only two kinds of internet connection on Windows: analytics to TelemetryDeck (§3(c)), used only while Analytics is switched on, and a language-model download from alphacephei.com (§3(b)), which happens when you ask for a model and, without being asked, for Windows’ first display language, at the first start on a connection that is not metered, and at later such starts until the model is added or the download cancelled. If you turn on Microsoft online speech (off by default), Windows itself sends your voice to Microsoft, in Voice mode only, for a language with no model on your PC (or whose model is still downloading), only for a language Windows lists for online speech and only while Windows’ own Online speech recognition setting is on (§3(b)). It always uses the Windows default microphone. That connection is made by Windows’ speech service for Wispim, not by Wispim’s own code, and Wispim’s package declares the internet capability for it. While Microsoft online speech is on, that service may also contact Microsoft outside a take, for example when Wispim starts, to check that online speech is available; it sends no audio then. Web links open in your default browser, and purchases (§5) run through the Microsoft Store on your PC.

(k) Windows backup. On Windows, Wispim has no backup or sync of its own. Your script library and app settings are files in Wispim’s data folder on your PC, and the free-take counter is kept in Windows Credential Manager, with a small marker file in the same data folder. If you use a backup or file-sync tool, whether Windows’ own or another, it may copy Wispim’s files with the rest of your PC under that tool’s own settings and terms; we have no access to any such copy.

4. Analytics events we send to TelemetryDeck

The app sends the following events, with the listed, non-identifying parameters. The list is complete: the app has no other analytics event and no other way of sending one.

• session_started (no parameters)
• onboarding_completed (no parameters)
• attribution_answered (source — which option you tapped, and nothing else; if you type an answer into “Other”, the text stays on your device and only the word Other is sent)
• prompter_started (mode, floating, backend, source — source is one of typed, imported, demo: where the script came from, never its title, a file name or a word of it)
• prompter_ended (mode, reason, progress, duration, restarted, takesUsed — reason is one of finished, closed_early, interrupted; progress is how far into the script the take got, one of under_10pct, 10_39, 40_69, 70_94, 95_plus per cent; duration is how long the take lasted, one of under_5, 5_19, 20_59, 60_179, 180_plus seconds; restarted is true if you restarted the take, otherwise false; takesUsed is the number of free takes used so far, or pro; never a position in the script, its length, its title or a word of it)
• floating_black_suspected (no parameters — the floating window came up blank)
• pip_transition_crash (step — the name of the last floating-window transition step reached before the app was terminated, with the time it was reached, truncated to 48 characters; a fixed step name, never a word of your script)
• mic_recovery (attempt, success)
• permission_answered (kind, outcome, moment — kind is mic or speech; outcome is granted or denied, and on Android also denied_permanently; moment is onboarding or take; sent only when you answer the system’s permission prompt, never to report a permission that was already decided)
• following_stalled (mode, language, onDevice, seconds, wordsInScript bucketed)
• following_stall_ended (mode, onDevice, resumed, duration — sent when a stall reported by following_stalled ends; resumed is true if the script moved on again and false if your voice stopped first; duration is how long the stall lasted, in the same bands as for prompter_ended; never a word of what was said)
• paywall_shown (trigger)
• paywall_plan_tapped (trigger, plan — which Pro product’s card you selected on the purchase screen, one of pro.monthly, pro.yearly, pro.lifetime; no price)
• paywall_closed (trigger, plan, result, duration — plan is the Pro product whose card was selected when the purchase screen closed, or none; result is one of purchased, restored, dismissed; duration is how long the screen was open, in the same bands as for prompter_ended; no price, account or payment detail)
• purchase (product — which of the Pro products was bought; no price, receipt or payment detail)
• purchase_started (product, trigger, sandbox — which Pro product you chose to buy, where the purchase screen was opened from (take_limit, import_gate or general), and on Apple devices whether the purchase runs in Apple’s test environment; no price, account or payment detail)
• purchase_outcome (product, trigger, outcome, sandbox, error — outcome is one of success, cancelled, pending, unverified, failed; error, sent only when a purchase failed, is one of network, not_allowed, unavailable, system, other; no price, receipt, account or payment detail)
• language_auto (scriptLocale — the language code the script was detected as, e.g. pl-PL; this is the script’s language, not your device’s)
• voice_command (command, mode — which command was recognised and in which scroll mode, never what was said around it)
• file_imported (format, size — the file format and a bucketed word count)
• file_import_failed (format, reason) — reason is one of a fixed set of nine short codes describing why the file could not be read: unreadable, unsupported, pdf_locked, pdf_no_text_layer, docx_not_zip, docx_no_main_part, docx_bad_xml, rtf_unreadable, empty. The file’s name and its contents are never sent.
• review_prompted (isPro, completedSessions)
• review_answered (answer — yes or not_really: the button you tapped when the app asked whether you enjoy Wispim; nothing you write and no star rating; not sent on Android)
• contact_opened (channel — which of the contact links in Settings was tapped, from a fixed list; never a destination or an address)
• test_signal (no parameters) — a connectivity check sent only when a developer taps “Send test signal” on the Diagnostics screen. That screen exists only in debug builds; a shipping build has no way to send it.

Two of these also carry a separate numeric parameter, floatValue, so the figures can be averaged: for mic_recovery it is the attempt count, for following_stalled the number of seconds. In both cases it repeats a value already listed above.

What is attached to every event. Wispim uses no third-party analytics SDK. The app sends the events above itself, and attaches the same seven technical values to each one of them:

• app version and build number — e.g. 1.0 and 1.
• device model — the hardware identifier, e.g. iPhone18,3, Mac14,2 or SM-A346B on Android. On Windows the app sends the fixed word PC instead; no hardware identifier is read for analytics.
• OS version — the major and minor version only, e.g. iOS 26.5, macOS 26.6 or Android 16.
• platform — which platform the app is running on, as one fixed lowercase word: ios, macos, android or windows. It carries no version number and no hardware detail; it is there only so that one analytics account can tell our apps apart.
• language — the app’s display language as a short code, e.g. en. On Windows it is instead the first language in your list of Windows display languages, without its region or script (pt-BR is sent as pt), so it can differ from the language Wispim itself is shown in. Your region is not sent, and neither is your time zone.
• whether the build is a debug build — always false in the version you install from the App Store, Google Play or the Microsoft Store.

Alongside them, each event carries the installation identifier described in §3(d), which is not linked to you, an identifier for the current session so that events from one use of the app can be grouped, a test-mode flag that keeps development traffic apart from real use, the name of the event, and our app’s identifier at TelemetryDeck. That is the complete list. Nothing else is attached to every event: no accessibility or appearance settings, no screen size, no usage or retention counters (the only counts sent are the ones listed with individual events above, such as completedSessions and takesUsed), no time zone, no region and no location of any kind.

For anyone comparing this list with what actually leaves the device: on the wire, every parameter name above is prefixed with our namespace, com.onwards. (for example com.onwards.scriptLocale), and the numeric parameter travels as com.onwards.floatValue.

No script text, transcripts, file names or audio are ever sent.

5. Purchases

If Wispim Pro is offered for purchase, purchases are made through Apple StoreKit on Apple devices and through Google Play’s billing system on Android as an auto-renewable monthly or yearly subscription or a one-time lifetime purchase (see the Terms of Use, §4a). The options and billing periods actually available are the ones shown in the app at that time. On Apple devices, Apple Distribution International Ltd. (Cork, Ireland) is the seller/merchant of record; on Android, Google Commerce Limited, Gordon House, Barrow Street, Dublin 4, Ireland is the seller for buyers in the European Economic Area. Your purchase, billing data and refunds are handled by the relevant store under its terms and privacy policy. Your name, payment details and receipts stay with the store; we never receive them. The Android app checks with Google Play on your phone whether you have Pro; no server of ours is involved. On Windows, purchases are made through the Microsoft Store’s in-app purchase system, as a monthly or yearly subscription or a one-time lifetime purchase, and the Windows app asks the Microsoft Store on your PC whether you have Pro; no server of ours is involved. The only purchase-related data we receive are the paywall_plan_tapped, paywall_closed, purchase, purchase_started and purchase_outcome events described in §4 — which product was looked at, chosen or bought, where the purchase screen was opened from, how long it stayed open and how the purchase ended, under the identifier of §3(d), which is not linked to you. No ads.

6. File import

You may optionally import TXT, Markdown, PDF, Word .docx and RTF files into the app. Import is processed locally on your device; neither the file, its name nor its content is sent to us. On Apple devices, an offline open-source library (ZIPFoundation) is used only to read Word documents. On Android, Word documents are read by Wispim’s own code with Android’s built-in tools, and an offline open-source library (PdfBox-Android) is used only to read PDF files. These libraries make no network connections and send no data anywhere. On Android, Wispim reads only the file you pick in Android’s file picker, and when you share text into Wispim from another app, it reads only that text. On Windows, Wispim reads only the file you pick in Windows’ file picker or drop on its window, and the text on the clipboard only when you paste it or choose New from Clipboard. Word documents and RTF files are read by Wispim’s own code with .NET’s built-in tools, and PDF files by an offline open-source library (PdfPig) that makes no network connections and sends no data anywhere. If an import fails, the app records only the format and one of the nine fixed reason codes listed in §4.

7. Support

If you email us at support@wispim.com, we process your email address and message content to answer you (GDPR Art. 6(1)(b)/(f)). You may voluntarily attach a diagnostic log; that log contains no script text and no audio.

On Apple devices, when you confirm sharing diagnostics, the app creates a compact ZIP containing technical event names and timings, app/build and operating-system versions, device model, Low Power Mode state, and the last audio input route. Heard words are replaced with placeholders; no script text, audio, transcript or file name is included. The file leaves the app only after you choose a destination in the system share sheet. If you send it to anyone other than us, or save it somewhere, the provider of the app or service you picked processes it under its own terms. On Android, “Help & feedback” opens your own mail app with a message to support@wispim.com already filled in: the app version, Android version and device model, and, if you choose to add diagnostics, the last lines of the app’s technical event log as plain text in the message. The log contains no script text, titles, transcripts or recognised words. You can read and change the message; nothing leaves your phone until you send it from your mail app. On Windows, Help & feedback (in Settings → General, and in the menu of the Wispim icon in the taskbar’s notification area) offers Email, Telegram, Instagram and the Microsoft Store. Email opens a message to support@wispim.com in your mail app, with the Wispim version, your Windows version and, when Windows reports it, your PC’s model added at the bottom. You can read and change the message; nothing leaves your PC until you send it from your mail app. If no mail app is set up, Wispim copies the address so you can write from somewhere else. Help & feedback on Windows attaches no log. If an error Wispim for Windows did not expect occurs, such as one that closes the app, Wispim notes the time, the type of error and where in its code it happened in a file named crash.log in its data folder on your PC; that file holds no script text or audio and is never sent. Wispim’s automatic test modes, which run only when the app is started from a command line with special options, write a log of their steps (ci.log) to the same folder; it holds no text of your scripts either and is never sent.

7a. This website

wispim.com is a static site hosted on Cloudflare Pages (Cloudflare, Inc., acting as our processor under Art. 28 GDPR). Serving a page writes an ordinary server log at Cloudflare: your IP address, the time, the page requested, the referring page and your browser’s user-agent string. Those logs exist to deliver the site and defend it against abuse (Art. 6(1)(f) GDPR), are kept for the short period Cloudflare’s own retention allows, and are not used to build a profile. Cloudflare also asks your browser to report network errors to Cloudflare itself; those reports go to Cloudflare, not to us.

The site sets no cookies of its own. Cloudflare may set its security cookies in front of the site (__cf_bm and cf_clearance); they carry no analytics and are not ours. The site stores your chosen light/dark theme in localStorage under wispim-theme. The browser teleprompter at /online-teleprompter additionally stores its local script and settings in that page’s browser storage; those values remain on your device. Its speech recognition is provided by the browser, not the Wispim app; browser speech recognition may send audio to the browser vendor or its speech-service provider for server processing under their terms, and the page warns before enabling it. Wispim never receives that audio or transcript. None of the app’s on-device speech wording applies to that browser tool.

Every font, image and script needed by the site comes from wispim.com itself: no external fonts, embeds or trackers. The single exception is Cloudflare Web Analytics, which Cloudflare adds at the edge and serves from static.cloudflareinsights.com; it counts page views without a cookie, browser storage or a cross-site identifier. Product analytics described in §3 and §4 are in the Wispim apps for iPhone, iPad, Mac, Android and Windows, not here. Links to Telegram, Instagram and the App Store are ordinary links: nothing reaches those services unless you follow one. Writing to support@wispim.com is covered by §7.

8. Retention

• On-device data — scripts, settings, the analytics preference (§3(e)) and any queue of not-yet-sent events — remains until you delete it or uninstall the app.
• The copy in your own iCloud (§3(a)), if you use iCloud sync: it remains in your Apple Account until you remove it. Switching the sync off does not delete it, and neither does deleting the app. To delete it, use Settings → iCloud → Remove the copy in iCloud in Wispim (on a Mac, Settings → Pro), or your device’s settings: on iPhone and iPad, the Settings app, your name → iCloud → Manage Account Storage; on a Mac, System Settings, your name → iCloud → Manage.
• Support emails: kept for as long as needed to handle your request and for 6 months after the request is closed, unless the establishment, exercise or defence of legal claims requires longer.
• The take counter: a single number, kept in the Keychain on your device. It holds no personal data, and it survives reinstalling the app.
• On Windows, the take counter is a single number with a signature, kept in Windows Credential Manager, which Wispim asks to keep on that PC, and a copy of the same number sits in the app’s own data folder. It holds no personal data, and it survives uninstalling and reinstalling the app.
• On Windows, crash.log and, if a test mode wrote one, ci.log (§7) stay in the app’s data folder until you delete them or uninstall the app. Once crash.log grows past 256 KB, Wispim deletes it and starts a new one.
• On Android, a copy in Android’s backup (§3(i)) is managed by Google under your Google account’s backup settings. The take counter on Android is kept in the app’s own storage and is part of Android’s backup, so it comes back after a reinstall when Android restores the backup. Videos recorded with Wispim’s camera: videos in Movies/Wispim stay on your phone until you delete them, including after you uninstall Wispim. Videos kept only in Wispim’s own folder are deleted with the app.
• Analytics: retained by TelemetryDeck under the identifier of §3(d), which is not linked to you, per its data-processing terms.

9. Recipients and third parties

We use no third-party analytics, advertising or tracking SDKs at all. Analytics events are sent by our own code directly to TelemetryDeck’s EU servers, as described in §3(c). Offline open-source libraries (ZIPFoundation on Apple devices, PdfBox-Android on Android and PdfPig on Windows) are used only to read documents on the device (§6). On Windows, your speech is recognised on your PC by the offline open-source Vosk library, with language models that Wispim downloads from the Vosk website, alphacephei.com, run by Alpha Cephei Inc. (when you ask, and by itself for Windows’ first display language, at the first start on a connection that is not metered and at later such starts until the model is added or the download cancelled; §3(b)), or that you add yourself. That website receives an ordinary download request, with your PC’s IP address and the name of the model; it receives no script text, no audio and no transcript. Your speech does not leave your PC, unless you turn on Microsoft online speech, which is off by default (see below and §3(b)). Apple on Apple devices and Google on Android act as independent parties for store purchases and server-based speech recognition; on Android, Google also holds Android’s backup if you use it (§3(i)). On Windows, store purchases are handled by the Microsoft Store under Microsoft’s own terms and privacy statement (https://privacy.microsoft.com/privacystatement); see §5. If you turn on Microsoft online speech on Windows (off by default), Microsoft also receives your voice while you read in a language with no model on your PC (or whose model is still downloading), to recognise it, and never in a language with a model on your PC; that is processed under the same Microsoft terms and privacy statement, and it happens only while Windows’ own Online speech recognition setting is on (§3(b)). On Windows, the links to the Microsoft Store, to your Microsoft account page (for managing a subscription) and to the Vosk model list are ordinary links: nothing reaches those pages unless you follow one. The Android app contains Google’s Play Billing Library, which exchanges purchase information with the Google Play app on your phone. The app also contains Google Play’s in-app review library: when Wispim offers the Google Play rating card, the stars and any review you enter go directly to Google Play, which publishes them as a review under your Google account; Wispim never receives them. Apart from that rating card, Telegram, Instagram, the App Store and Google Play receive data only after you tap their links and leave Wispim; their own terms and privacy policies then apply. The host of our website receives the connection data described in §3(f) when you open these documents from inside the app.

10. International transfers

Analytics data is stored exclusively in the EU. Where Apple or Google, or on Windows Microsoft, processes audio for server-based speech recognition, or Google keeps an Android backup, it may transfer data internationally under its own safeguards (GDPR Arts. 44–49). Cloudflare may process website connection data outside the European Economic Area. Cloudflare’s Data Processing Addendum provides the EU–US Data Privacy Framework and, where required, the EU Standard Contractual Clauses and supplementary safeguards for those transfers.

11. Your rights

Under the GDPR (Arts. 12–22) and the ustawa z dnia 10 maja 2018 r. o ochronie danych osobowych you have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time. The simplest way to object to analytics is the switch described in §3(e). Because we operate without accounts and the analytics identifier is one we cannot link to a person (§3(d)), Art. 11 GDPR applies: we are normally unable to tell which installation is yours, and for a request concerning analytics data we may ask you for additional information or be unable to act on it. To exercise a right, email support@wispim.com.

You may lodge a complaint with the supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl.

12. Children

Wispim is a general-audience app and is not directed at children under 13. Consistent with COPPA (16 CFR §312.2), it is intended for a general audience and we do not knowingly collect personal data from children under 13.

13. California notice (voluntary)

We do not sell or share personal information as defined by the CCPA/CPRA. We are below all CCPA thresholds — for the 2026 compliance year these are annual gross revenue over $26,625,000 (CPI-adjusted from $25,000,000 per the California Privacy Protection Agency’s 17 December 2024 announcement), buying/selling/sharing the personal information of 100,000+ California consumers or households, or deriving 50%+ of revenue from selling/sharing personal information. This notice is provided voluntarily.

14. UK users

For users in the UK, the UK GDPR applies as retained/assimilated law; you may contact the Information Commissioner’s Office (ICO), ico.org.uk. Our practices are the same as described above.

15. Changes

We will update this policy as needed and bump the version number and effective date.

Version 1.13 (21 October 2026) — this policy now also covers Wispim for Windows, from the Microsoft Store: §1 names the Windows app and its package; §2 and §3(a) say that on Windows your scripts and settings stay in the app’s data folder on your PC, with no sync; §3(b) describes speech recognition on the PC with the offline Vosk library, the microphone, the level meter in Settings → Voice, downloading a speech model from alphacephei.com (the first by itself, others when you ask) or adding one yourself, and Microsoft online speech, which is off by default and, when on, sends the voice of a language with no model on the PC to Microsoft, and its closing bullet names Microsoft beside Apple and Google for server-based processing; §3(e) says that the analytics switch is off by default on Windows, so that no event listed in §4 is sent there until you turn it on, and where the switch is; §3(d) says that the Windows installation value is generated when you turn analytics on rather than on first run, and is erased when you turn analytics off, so that the events sent before and the events sent after cannot be connected to each other; §3(f) says that on Windows these documents open in your browser; new §3(j) and §3(k) cover permissions and backup on Windows, and §3(j) names the internet connections: analytics, the speech-model download, and the online speech Windows makes when you turn it on; §4 says that Windows sends PC as the device model, that its language value comes from your list of Windows display languages, and that the debug flag is false in the Microsoft Store version; §5 describes Microsoft Store purchases; §6 covers file and clipboard import on Windows; §7 describes Help & feedback on Windows and the local crash.log file, which is never sent; §7a names the Windows app; §8 says where the Windows take counter is kept and how long crash.log stays; §9 names PdfPig, Vosk, the model download host and the Microsoft Store, and Microsoft as a recipient of the voice if you turn on online speech; §10 adds Microsoft to the providers that may transfer audio internationally. §3(b) also says that on Apple devices a take falls back to Apple’s servers when on-device recognition stops following what you read, and returns to on-device recognition if the servers cannot be reached; §4 adds the events prompter_ended, permission_answered, following_stall_ended, paywall_plan_tapped, paywall_closed and review_answered and the source parameter of prompter_started, and says that nothing else is attached to every event; §5 names the two new purchase-screen events. The list of technical values attached to every event in §4 is unchanged.

Version 1.12 (18 October 2026) — §4’s list of platform words gains a fourth, windows, and §3(d) says how the identifier is formed there: on Windows no device or machine identifier is read at all; the app generates a random value for the installation and reduces it, with its own salt, to the same one-way hash. The number of technical values is still seven, and nothing about what we receive from the Apple and Android apps changed.

Version 1.11 (18 October 2026) — §4 adds a seventh technical value, the platform the app runs on, as one fixed lowercase word (ios, macos or android). It carries no version number and no hardware detail, and it is there only so that one analytics account can tell our apps apart. Nothing else about what we receive changed.

Version 1.10 (16 October 2026) — §4 adds two analytics events, purchase_started and purchase_outcome: that a purchase of Wispim Pro started (which product, where the purchase screen was opened from and, on Apple devices, whether the purchase runs in Apple’s test environment) and how it ended, with a fixed short error code if it failed; §5 names them. No price, receipt, account or payment detail is sent. Nothing else about what we receive changed.

Version 1.9 (2 October 2026) — the Privacy Policy now also covers Android: §1 and §2 name the app; §3(b) describes Android speech recognition, including languages that use Google’s servers; new §3(g)–(i) cover camera recording, Android permissions and backup; §3(d)–(f), §4–§10 give Android-specific details; §5 names Google Commerce Limited as seller for EEA Google Play purchases. Nothing about what we receive changed.

Version 1.8 (28 September 2026) — the app is now also for iPad and Mac (§1); §3(a) and §8 give the Mac’s place for the iCloud switch and for removing the iCloud copy, and the system path on each device; §3(b) says that Sound mode, like Constant, can listen for voice commands, recognised only on your device, and names the operating system rather than iOS; §4 adds Mac examples; §7 names the operating-system version; §7a refers to the Wispim app rather than the iPhone app. Nothing about what we receive changed. Version 1.7 (24 September 2026) — §3(a) now says that iCloud sync is on by default once you have Wispim Pro; §3(b) says that Constant-mode voice commands are recognised only on your device, and that the server-fallback banner appears in the full-screen prompter but not in the floating window; §7 says that a diagnostics file you send anywhere other than to us is processed under that provider’s own terms. Nothing about what we receive changed. Version 1.6 (21 September 2026) — optional iCloud sync of the script library was described in §2, §3(a) and §8: with Wispim Pro and the switch on, a copy of your library is kept in the private CloudKit database of your own Apple Account, under your own storage quota, which we cannot read and which never reaches us; §8 says how to delete that copy. Nothing about what we receive changed. Version 1.5 (16 September 2026) — Voice, Sound and optional Constant voice-command processing were clarified; diagnostics and supported import formats were expanded; the website and browser teleprompter disclosure was synchronized; links opened to Telegram, Instagram and the App Store were clarified; the UODO address was updated; and the former trading-name wording was removed while retaining the frozen com.onwards analytics namespace. Version 1.4 (8 September 2026) — the on-device take counter was added to §8, the website disclosure was added, and the trading name was removed from §1. Version 1.3 (8 September 2026) — the analytics identifier was described as not linked to you. Version 1.2 (5 September 2026) — the analytics SDK was removed from the app and replaced with our own client; §3(c)–(f) and §4 were aligned with it, and the contact address changed to support@wispim.com. Version 1.1 (3 September 2026) moved these documents from German to Polish law.

16. Controlling language

This Privacy Policy is published in English, Polish, German and Russian. The English version controls in case of conflict, except that for consumers resident in Poland the Polish version prevails where mandatory Polish consumer law or the Act on the Polish Language (ustawa o języku polskim) so requires.

-----